更新: 421 个文件 - 2026-03-17 18:30:02

这个提交包含在:
hao
2026-03-17 18:30:02 -07:00
父节点 29c3faaa28
当前提交 a3edc88834
修改 421 个文件,包含 12474 行新增5845 行删除

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:11+00:00`
- 最近渲染时间: `2026-03-18T01:29:31+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:11+00:00`
- 最近渲染时间: `2026-03-18T01:29:31+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:11+00:00`
- 最近渲染时间: `2026-03-18T01:29:31+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:11+00:00`
- 最近渲染时间: `2026-03-18T01:29:31+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:11+00:00`
- 最近渲染时间: `2026-03-18T01:29:31+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:11+00:00`
- 最近渲染时间: `2026-03-18T01:29:31+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:11+00:00`
- 最近渲染时间: `2026-03-18T01:29:31+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:11+00:00`
- 最近渲染时间: `2026-03-18T01:29:31+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:11+00:00`
- 最近渲染时间: `2026-03-18T01:29:31+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:11+00:00`
- 最近渲染时间: `2026-03-18T01:29:31+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:11+00:00`
- 最近渲染时间: `2026-03-18T01:29:31+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:11+00:00`
- 最近渲染时间: `2026-03-18T01:29:31+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:11+00:00`
- 最近渲染时间: `2026-03-18T01:29:31+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:11+00:00`
- 最近渲染时间: `2026-03-18T01:29:31+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:11+00:00`
- 最近渲染时间: `2026-03-18T01:29:31+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:11+00:00`
- 最近渲染时间: `2026-03-18T01:29:31+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:11+00:00`
- 最近渲染时间: `2026-03-18T01:29:31+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:11+00:00`
- 最近渲染时间: `2026-03-18T01:29:31+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:13+00:00`
- 最近渲染时间: `2026-03-18T01:29:35+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:14+00:00`
- 最近渲染时间: `2026-03-18T01:29:36+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:13+00:00`
- 最近渲染时间: `2026-03-18T01:29:35+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:14+00:00`
- 最近渲染时间: `2026-03-18T01:29:36+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:14+00:00`
- 最近渲染时间: `2026-03-18T01:29:36+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:14+00:00`
- 最近渲染时间: `2026-03-18T01:29:36+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:13+00:00`
- 最近渲染时间: `2026-03-18T01:29:35+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:13+00:00`
- 最近渲染时间: `2026-03-18T01:29:35+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:14+00:00`
- 最近渲染时间: `2026-03-18T01:29:36+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:14+00:00`
- 最近渲染时间: `2026-03-18T01:29:36+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:13+00:00`
- 最近渲染时间: `2026-03-18T01:29:35+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:13+00:00`
- 最近渲染时间: `2026-03-18T01:29:35+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:14+00:00`
- 最近渲染时间: `2026-03-18T01:29:36+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:13+00:00`
- 最近渲染时间: `2026-03-18T01:29:35+00:00`
## 目标约束

查看文件

@@ -5,14 +5,14 @@
- 系统 ID: `nextjs`
- 分类: `frameworks`
- 覆盖策略: `history-full`
- 总案例数: `26`
- 近 30 天新增/更新: `5`
- 重点 Markdown 案例数: `26`
- 已实证(真实版本): `0`
- 总案例数: `24`
- 近 30 天新增/更新: `3`
- 重点 Markdown 案例数: `24`
- 已实证(真实版本): `1`
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `26`
- 最近渲染时间: `2026-03-17T12:57:12+00:00`
- 待人工/缺浏览器证据: `23`
- 最近渲染时间: `2026-03-18T01:29:34+00:00`
## 目标约束
@@ -47,14 +47,12 @@
| Information exposure in Next.js dev server due to lack of origin verification | `medium` | `generated` | `triage-manual` | `synthetic` | `official` | `2025-06-13T14:41:21Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-48068.md) |
| Next.js Race Condition to Cache Poisoning | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2025-09-26T17:48:29Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-32421.md) |
| Next.js may leak x-middleware-subrequest-id to external hosts | `medium` | `generated` | `triage-manual` | `synthetic` | `official` | `2025-10-13T15:35:50Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-30218.md) |
| Authorization Bypass in Next.js Middleware | `low` | `generated` | `triage-manual` | `real` | `official` | `2026-03-04T15:06:29.993197Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-29927.md) |
| Next.js Allows a Denial of Service (DoS) with Server Actions | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-02-04T04:36:04.252972Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-56332.md) |
| Next.js authorization bypass vulnerability | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2025-09-10T21:12:24Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-51479.md) |
| Next.js authorization bypass vulnerability | `low` | `generated` | `verified-real` | `real` | `official` | `2025-09-10T21:12:24Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-51479.md) |
| Denial of Service condition in Next.js image optimization | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-02-04T03:25:43.295558Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-47831.md) |
| Next.js Cache Poisoning | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-02-04T03:45:33.402195Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-46982.md) |
| Next.js Server-Side Request Forgery in Server Actions | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-02-04T03:32:36.434669Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-34351.md) |
| Unexpected server crash in Next.js. | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-13T22:00:36.554552Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2021-43803.md) |
| XSS in Image Optimization API for Next.js | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-13T22:00:20.154452Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2021-39178.md) |
| Open Redirect in Next.js | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-13T22:00:08.038285Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2021-37699.md) |
| Open Redirect in Next.js versions | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-13T22:14:13.665535Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2020-15242.md) |
| Directory Traversal in Next.js | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2025-09-26T17:49:56Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2020-5284.md) |

查看文件

@@ -8,10 +8,10 @@ updated_date: "2026-03-13T22:14:13.665535Z"
severity: "low"
exploit_status: "unknown"
source_confidence: "official"
verification_status: "triage-manual"
verification_mode: "synthetic"
artifact_mode: "synthetic"
last_run_id: ""
verification_status: "verified-real"
verification_mode: "real"
artifact_mode: "local-fixture"
last_run_id: "nextjs-nextjs--CVE-2020-15242-20260318012830"
target_types:
- "lab-local"
- "lab-public"
@@ -37,12 +37,12 @@ primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-x56p
## 本地实证状态
- 实证状态: `triage-manual`
- 实证方式: `synthetic`
- Artifact 模式: `synthetic`
- 最近运行: `-`
- 浏览器证据: `missing`
- Run Bundle: `-`
- 实证状态: `verified-real`
- 实证方式: `real`
- Artifact 模式: `local-fixture`
- 最近运行: `nextjs-nextjs--CVE-2020-15242-20260318012830`
- 浏览器证据: `present`
- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830`
## 事件层

查看文件

@@ -8,10 +8,10 @@ updated_date: "2025-09-10T21:12:24Z"
severity: "low"
exploit_status: "unknown"
source_confidence: "official"
verification_status: "triage-manual"
verification_mode: "synthetic"
artifact_mode: "synthetic"
last_run_id: ""
verification_status: "verified-real"
verification_mode: "real"
artifact_mode: "local-fixture"
last_run_id: "nextjs-nextjs--CVE-2024-51479-20260318012913"
target_types:
- "lab-local"
- "lab-public"
@@ -37,12 +37,12 @@ primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-7gfc
## 本地实证状态
- 实证状态: `triage-manual`
- 实证方式: `synthetic`
- Artifact 模式: `synthetic`
- 最近运行: `-`
- 实证状态: `verified-real`
- 实证方式: `real`
- Artifact 模式: `local-fixture`
- 最近运行: `nextjs-nextjs--CVE-2024-51479-20260318012913`
- 浏览器证据: `missing`
- Run Bundle: `-`
- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2024-51479-20260318012913`
## 事件层

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:13+00:00`
- 最近渲染时间: `2026-03-18T01:29:35+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:12+00:00`
- 最近渲染时间: `2026-03-18T01:29:34+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:14+00:00`
- 最近渲染时间: `2026-03-18T01:29:36+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:11+00:00`
- 最近渲染时间: `2026-03-18T01:29:31+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:14+00:00`
- 最近渲染时间: `2026-03-18T01:29:36+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:14+00:00`
- 最近渲染时间: `2026-03-18T01:29:36+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:14+00:00`
- 最近渲染时间: `2026-03-18T01:29:36+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:13+00:00`
- 最近渲染时间: `2026-03-18T01:29:35+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:14+00:00`
- 最近渲染时间: `2026-03-18T01:29:36+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `14`
- 最近渲染时间: `2026-03-17T12:57:14+00:00`
- 最近渲染时间: `2026-03-18T01:29:36+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `12`
- 最近渲染时间: `2026-03-17T12:57:13+00:00`
- 最近渲染时间: `2026-03-18T01:29:35+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:12+00:00`
- 最近渲染时间: `2026-03-18T01:29:34+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:14+00:00`
- 最近渲染时间: `2026-03-18T01:29:36+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:14+00:00`
- 最近渲染时间: `2026-03-18T01:29:36+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:14+00:00`
- 最近渲染时间: `2026-03-18T01:29:36+00:00`
## 目标约束

查看文件

@@ -5,14 +5,14 @@
- 系统 ID: `gitea`
- 分类: `platforms`
- 覆盖策略: `rolling-24m`
- 总案例数: `37`
- 近 30 天新增/更新: `37`
- 重点 Markdown 案例数: `37`
- 总案例数: `30`
- 近 30 天新增/更新: `30`
- 重点 Markdown 案例数: `30`
- 已实证(真实版本): `0`
- 已实证(synthetic): `0`
- 阻塞数: `1`
- 待人工/缺浏览器证据: `36`
- 最近渲染时间: `2026-03-17T12:57:16+00:00`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `30`
- 最近渲染时间: `2026-03-18T01:29:38+00:00`
## 目标约束
@@ -42,8 +42,6 @@
| Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea | `unknown` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-03T04:57:55.747880Z` | [link](/Users/x/websafe/07-framework-security/platforms/gitea/cases/gitea-cve-2026-20912.md) |
| Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea | `unknown` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-03T04:57:49.801641Z` | [link](/Users/x/websafe/07-framework-security/platforms/gitea/cases/gitea-cve-2025-69413.md) |
| Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea | `unknown` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-03T04:57:49.095775Z` | [link](/Users/x/websafe/07-framework-security/platforms/gitea/cases/gitea-cve-2025-68938.md) |
| Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea | `unknown` | `generated` | `blocked-artifact` | `real` | `official` | `2026-03-03T04:57:48.777563Z` | [link](/Users/x/websafe/07-framework-security/platforms/gitea/cases/gitea-cve-2025-68939.md) |
| Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea | `unknown` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-03T04:57:50.087298Z` | [link](/Users/x/websafe/07-framework-security/platforms/gitea/cases/gitea-cve-2025-68940.md) |
| Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea | `unknown` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-03T04:57:50.339953Z` | [link](/Users/x/websafe/07-framework-security/platforms/gitea/cases/gitea-cve-2025-68941.md) |
| Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea | `unknown` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-03T04:57:49.781753Z` | [link](/Users/x/websafe/07-framework-security/platforms/gitea/cases/gitea-cve-2025-68942.md) |
| Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea | `unknown` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-03T04:57:49.213758Z` | [link](/Users/x/websafe/07-framework-security/platforms/gitea/cases/gitea-cve-2025-68943.md) |
@@ -52,9 +50,6 @@
| Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea | `unknown` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-03T04:57:50.473303Z` | [link](/Users/x/websafe/07-framework-security/platforms/gitea/cases/gitea-cve-2025-68946.md) |
| Gitea vulnerable to Argument Injection in code.gitea.io/gitea | `unknown` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-03T04:52:41.181693Z` | [link](/Users/x/websafe/07-framework-security/platforms/gitea/cases/gitea-cve-2022-42968.md) |
| Improper Privilege Management in Gitea in code.gitea.io/gitea | `unknown` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-03T04:52:33.136607Z` | [link](/Users/x/websafe/07-framework-security/platforms/gitea/cases/gitea-cve-2021-45330.md) |
| Gitea Remote Code Execution (RCE) in code.gitea.io/gitea | `unknown` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-03T04:52:20.787387Z` | [link](/Users/x/websafe/07-framework-security/platforms/gitea/cases/gitea-cve-2018-18926.md) |
| Denial of Service in Gitea in code.gitea.io/gitea | `unknown` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-03T04:52:17.939867Z` | [link](/Users/x/websafe/07-framework-security/platforms/gitea/cases/gitea-cve-2020-13246.md) |
| Cross-site Scripting in Gitea in code.gitea.io/gitea | `unknown` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-03T04:52:18.307544Z` | [link](/Users/x/websafe/07-framework-security/platforms/gitea/cases/gitea-cve-2021-28378.md) |
| Gitea Missing Authorization vulnerability in code.gitea.io/gitea | `unknown` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-03T04:50:45.472605Z` | [link](/Users/x/websafe/07-framework-security/platforms/gitea/cases/gitea-cve-2022-0905.md) |
| Stored Cross-site Scripting in gitea in code.gitea.io/gitea | `unknown` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-03T04:50:45.577318Z` | [link](/Users/x/websafe/07-framework-security/platforms/gitea/cases/gitea-cve-2022-1928.md) |
| Arbitrary file deletion in gitea in code.gitea.io/gitea | `unknown` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-03T04:50:19.647131Z` | [link](/Users/x/websafe/07-framework-security/platforms/gitea/cases/gitea-cve-2022-27313.md) |
@@ -63,8 +58,6 @@
| Reuse of one time passwords allowed in Gitea in code.gitea.io/gitea | `unknown` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-03T04:52:07.604662Z` | [link](/Users/x/websafe/07-framework-security/platforms/gitea/cases/gitea-cve-2021-45331.md) |
| Capture-replay in Gitea in code.gitea.io/gitea | `unknown` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-03T04:52:07.840324Z` | [link](/Users/x/websafe/07-framework-security/platforms/gitea/cases/gitea-cve-2021-45327.md) |
| Gitea erroneous repo clones in code.gitea.io/gitea | `unknown` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-03T04:54:07.076900Z` | [link](/Users/x/websafe/07-framework-security/platforms/gitea/cases/gitea-cve-2022-38795.md) |
| Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea | `unknown` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-03T04:54:04.686907Z` | [link](/Users/x/websafe/07-framework-security/platforms/gitea/cases/gitea-cve-2018-15192.md) |
| Gitea XSS Vulnerability in code.gitea.io/gitea | `unknown` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-03T04:53:57.848904Z` | [link](/Users/x/websafe/07-framework-security/platforms/gitea/cases/gitea-cve-2019-1010261.md) |
| Gitea allowed assignment of private issues in code.gitea.io/gitea | `unknown` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-03T04:55:04.505871Z` | [link](/Users/x/websafe/07-framework-security/platforms/gitea/cases/gitea-cve-2022-38183.md) |
| Buffer Overflow in gitea in code.gitea.io/gitea | `unknown` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-03T04:55:15.307648Z` | [link](/Users/x/websafe/07-framework-security/platforms/gitea/cases/gitea-cve-2021-3382.md) |
| Gitea Open Redirect in code.gitea.io/gitea | `unknown` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-03T04:51:49.844240Z` | [link](/Users/x/websafe/07-framework-security/platforms/gitea/cases/gitea-cve-2022-1058.md) |

查看文件

@@ -8,10 +8,10 @@ updated_date: "2026-03-03T04:54:04.686907Z"
severity: "unknown"
exploit_status: "unknown"
source_confidence: "official"
verification_status: "triage-manual"
verification_mode: "synthetic"
artifact_mode: "synthetic"
last_run_id: ""
verification_status: "verified-real"
verification_mode: "real"
artifact_mode: "local-fixture"
last_run_id: "gitea-gitea--CVE-2018-15192-20260318012749"
target_types:
- "lab-local"
- "lab-public"
@@ -41,12 +41,12 @@ primary_source: "https://github.com/advisories/GHSA-fg3x-rwq9-74cw"
## 本地实证状态
- 实证状态: `triage-manual`
- 实证方式: `synthetic`
- Artifact 模式: `synthetic`
- 最近运行: `-`
- 实证状态: `verified-real`
- 实证方式: `real`
- Artifact 模式: `local-fixture`
- 最近运行: `gitea-gitea--CVE-2018-15192-20260318012749`
- 浏览器证据: `missing`
- Run Bundle: `-`
- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-15192-20260318012749`
## 事件层

查看文件

@@ -8,10 +8,10 @@ updated_date: "2026-03-03T04:52:20.787387Z"
severity: "unknown"
exploit_status: "unknown"
source_confidence: "official"
verification_status: "triage-manual"
verification_mode: "synthetic"
artifact_mode: "synthetic"
last_run_id: ""
verification_status: "verified-real"
verification_mode: "real"
artifact_mode: "local-fixture"
last_run_id: "gitea-gitea--CVE-2018-18926-20260318012526"
target_types:
- "lab-local"
- "lab-public"
@@ -38,12 +38,12 @@ primary_source: "https://github.com/advisories/GHSA-hf6f-jq25-8gq9"
## 本地实证状态
- 实证状态: `triage-manual`
- 实证方式: `synthetic`
- Artifact 模式: `synthetic`
- 最近运行: `-`
- 浏览器证据: `missing`
- Run Bundle: `-`
- 实证状态: `verified-real`
- 实证方式: `real`
- Artifact 模式: `local-fixture`
- 最近运行: `gitea-gitea--CVE-2018-18926-20260318012526`
- 浏览器证据: `present`
- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526`
## 事件层

查看文件

@@ -8,10 +8,10 @@ updated_date: "2026-03-03T04:53:57.848904Z"
severity: "unknown"
exploit_status: "unknown"
source_confidence: "official"
verification_status: "triage-manual"
verification_mode: "synthetic"
artifact_mode: "synthetic"
last_run_id: ""
verification_status: "verified-real"
verification_mode: "real"
artifact_mode: "local-fixture"
last_run_id: "gitea-gitea--CVE-2019-1010261-20260318012624"
target_types:
- "lab-local"
- "lab-public"
@@ -39,12 +39,12 @@ primary_source: "https://github.com/advisories/GHSA-5rh7-6gfj-mc87"
## 本地实证状态
- 实证状态: `triage-manual`
- 实证方式: `synthetic`
- Artifact 模式: `synthetic`
- 最近运行: `-`
- 浏览器证据: `missing`
- Run Bundle: `-`
- 实证状态: `verified-real`
- 实证方式: `real`
- Artifact 模式: `local-fixture`
- 最近运行: `gitea-gitea--CVE-2019-1010261-20260318012624`
- 浏览器证据: `present`
- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624`
## 事件层

查看文件

@@ -8,10 +8,10 @@ updated_date: "2026-03-03T04:52:17.939867Z"
severity: "unknown"
exploit_status: "unknown"
source_confidence: "official"
verification_status: "triage-manual"
verification_mode: "synthetic"
artifact_mode: "synthetic"
last_run_id: ""
verification_status: "verified-real"
verification_mode: "real"
artifact_mode: "local-fixture"
last_run_id: "gitea-gitea--CVE-2020-13246-20260318012806"
target_types:
- "lab-local"
- "lab-public"
@@ -39,12 +39,12 @@ primary_source: "https://github.com/advisories/GHSA-g2qx-6ghw-67hm"
## 本地实证状态
- 实证状态: `triage-manual`
- 实证方式: `synthetic`
- Artifact 模式: `synthetic`
- 最近运行: `-`
- 浏览器证据: `missing`
- Run Bundle: `-`
- 实证状态: `verified-real`
- 实证方式: `real`
- Artifact 模式: `local-fixture`
- 最近运行: `gitea-gitea--CVE-2020-13246-20260318012806`
- 浏览器证据: `present`
- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806`
## 事件层

查看文件

@@ -8,10 +8,10 @@ updated_date: "2026-03-03T04:52:18.307544Z"
severity: "unknown"
exploit_status: "unknown"
source_confidence: "official"
verification_status: "triage-manual"
verification_mode: "synthetic"
artifact_mode: "synthetic"
last_run_id: ""
verification_status: "verified-real"
verification_mode: "real"
artifact_mode: "local-fixture"
last_run_id: "gitea-gitea--CVE-2021-28378-20260318012813"
target_types:
- "lab-local"
- "lab-public"
@@ -40,12 +40,12 @@ primary_source: "https://github.com/advisories/GHSA-g95p-88p4-76cm"
## 本地实证状态
- 实证状态: `triage-manual`
- 实证方式: `synthetic`
- Artifact 模式: `synthetic`
- 最近运行: `-`
- 浏览器证据: `missing`
- Run Bundle: `-`
- 实证状态: `verified-real`
- 实证方式: `real`
- Artifact 模式: `local-fixture`
- 最近运行: `gitea-gitea--CVE-2021-28378-20260318012813`
- 浏览器证据: `present`
- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813`
## 事件层

查看文件

@@ -8,10 +8,10 @@ updated_date: "2026-03-03T04:57:50.087298Z"
severity: "unknown"
exploit_status: "unknown"
source_confidence: "official"
verification_status: "triage-manual"
verification_mode: "synthetic"
artifact_mode: "synthetic"
last_run_id: ""
verification_status: "verified-real"
verification_mode: "real"
artifact_mode: "local-fixture"
last_run_id: "gitea-gitea--CVE-2025-68940-20260318012708"
target_types:
- "lab-local"
- "lab-public"
@@ -39,12 +39,12 @@ primary_source: "https://github.com/advisories/GHSA-rrcw-5rjv-vj26"
## 本地实证状态
- 实证状态: `triage-manual`
- 实证方式: `synthetic`
- Artifact 模式: `synthetic`
- 最近运行: `-`
- 实证状态: `verified-real`
- 实证方式: `real`
- Artifact 模式: `local-fixture`
- 最近运行: `gitea-gitea--CVE-2025-68940-20260318012708`
- 浏览器证据: `missing`
- Run Bundle: `-`
- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2025-68940-20260318012708`
## 事件层

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:16+00:00`
- 最近渲染时间: `2026-03-18T01:29:38+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:16+00:00`
- 最近渲染时间: `2026-03-18T01:29:38+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:16+00:00`
- 最近渲染时间: `2026-03-18T01:29:38+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:16+00:00`
- 最近渲染时间: `2026-03-18T01:29:38+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:16+00:00`
- 最近渲染时间: `2026-03-18T01:29:38+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:14+00:00`
- 最近渲染时间: `2026-03-18T01:29:36+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:16+00:00`
- 最近渲染时间: `2026-03-18T01:29:38+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:14+00:00`
- 最近渲染时间: `2026-03-18T01:29:36+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:14+00:00`
- 最近渲染时间: `2026-03-18T01:29:36+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:14+00:00`
- 最近渲染时间: `2026-03-18T01:29:36+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:14+00:00`
- 最近渲染时间: `2026-03-18T01:29:36+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:14+00:00`
- 最近渲染时间: `2026-03-18T01:29:36+00:00`
## 目标约束

查看文件

@@ -12,7 +12,7 @@
- 已实证(synthetic): `0`
- 阻塞数: `0`
- 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-17T12:57:14+00:00`
- 最近渲染时间: `2026-03-18T01:29:36+00:00`
## 目标约束